---
title: "Post Legal Accept"
method: POST
path: "/api/legal/accept"
tags: ["legal"]
---

# Post Legal Accept

`POST /api/legal/accept`

## Request

- Base URL: `https://api.civilquants.com` (the document declares no server; this is the origin it was published from)
- URL: `https://api.civilquants.com/api/legal/accept`
- Auth: none declared

Record a click-wrap acceptance of ToS + Privacy + Cookie v<current>.

Rejects (409) if the caller submits stale policy versions — the page
they clicked through pre-dates a policy bump and they need to
re-render against the live versions before accepting.

IP is HMAC-SHA256 hashed before storage (GDPR Art 5(1)(c)). The plan
locks the gate at IP granularity: a single acceptance from an IP
covers both `free_ppc` and `free_mcp` for the 24h window. The
`surface` field on the row records which landing page generated the
click for analytics.

## Request body

- AcceptanceRequest: Body schema for POST /legal/accept.
  - `tos_version` string, required
  - `privacy_version` string, required
  - `cookie_version` string, required
  - `surface` 'free_ppc' | 'free_agg' | 'free_mcp', required

## Response `200`

Successful Response

- object

## Other responses

- `422`: Validation Error

---

[API](https://skmtc.dev/civilquants/apis/civilquants-api.md) · [All operations](https://skmtc.dev/civilquants/apis/civilquants-api/llms.txt) · [OpenAPI document](https://skmtc.dev/civilquants/apis/civilquants-api/revisions/84569a3761e1?raw)